Repository navigation
KYAML step 6/6 — workflows, only if step 4 rules them in scope #1025
Description
Step 6 of 6 in the KYAML adoption order fixed by 3-practice/YAML-POLICY.adoc §5.
Blocked by #1024, and gated on the #1023 ruling admitting workflows at all.
Work
Workflows (9,261) — only if step 4 ruled them in scope.
Gate (§5)
Additionally: Dependabot and
gh actions-lockeither emit KYAML or their
drift is explicitly accepted in writing. Unresolved, this step does not start.
Acceptance criteria
- KYAML step 4/6 — decide KYAML scope on the evidence (owner ruling) #1023 ruled workflows in scope. Absent that ruling this issue stays shut.
- Dependabot's emitted YAML: either KYAML, or its drift accepted in writing.
-
gh actions-lock's emitted YAML: same disposition, in writing. - ⚠
gh actions-lock's extractor is tested against flow-style mappings
before any workflow is converted. It reads step-leveluses:; if it cannot
see them in KYAML, a converted workflow loses its lock coverage and a
workflow absent fromactions.lockdies at startup withjobs=0. -
actionlintaccepts the converted form, or its replacement does. - Every converted workflow is verified to have run —
jobs >= 1plus an
executed-step marker, per the KYAML step 1/6 — probe whether GitHub Actions parses a KYAML workflow #1020 method. A green square is not a pass,
and a startup death is not an honest red. - Converted in reversible batches, never estate-wide in one commit.
🤖 Generated with Claude Code
Activity
docs(policy): cross-reference the six booked KYAML adoption issues
docs(policy): cross-reference the six booked KYAML adoption issues (#…
hyperpolymath commentedon Oct 1, 2026
D280 (#787) put workflows IN scope, gated on a shim. The step-4 condition for this issue is now met, with one prerequisite added as the first acceptance criterion:
gh actions-lockv0.1.6 does not seeuses:in a KYAML workflow (planted unlocked SHA →valid: true; block control →stale). Before the first conversion, a yq-based check must be in place as a required context. It asserts, per workflow,yq '.. | select(has("uses")) | .uses'⊆ that workflow's ownactions.lockkey, because GitHub's runtime enforces per-workflow keying (unkeyed ⇒ startup death).uses ⊆ actions.lock(.githooks/validate-actions-lock.sh) catches an unlocked SHA in KYAML (rc=1). Whether it checks per-workflow keying is unmeasured (my probe's plant did not apply). The shim must kill a mutant that uses a SHA locked for a different workflow, on both syntaxes.gh actions-lock(fix mode) may drop a KYAML workflow's section, since the tool cannot see its refs.github/gh-actions-lock(owner step: third-party). The shim retires when upstream lands.scripts/kyaml-format.sh(feat(yaml): kyaml-format.sh, a KYAML formatter with --check (#1022) #1117) only.🤖 Generated with Claude Code
https://claude.ai/code/session_01W5CoaksP2Bg21HpDCgFgwS
⚠ Basis correction (2026-10-01T23:4xZ, same session): two claims above are wrong
The owner's choice is unchanged. Two facts that were offered in support of it are wrong.
1.
gh actions-lockv0.1.6 is NOT blind to KYAML. I re-ran the probe with the same ref in both syntaxes, planted intoboj-build.ymlin a throwaway copy ofmain@71bb615e:actions/setup-node@v4not-pinnednot-pinnedactions/setup-node@49933ea…(not in lock)The syntax makes no difference; what matters is the kind of ref.
--verify-localchecks tag refs and accepts any bare SHA as already pinned. The earlier "positive control" almost certainly planted a different kind of ref in each arm. No upstream KYAML bug will be filed.2. "Unkeyed ⇒ startup death" is wrong. Measured 2026-09-23 on live heads: a workflow with no
actions.lockkey runs normally, anduuid-v7.ymlonmainis a live instance (1 job, 5 steps, success). Only a key that is present and disagrees with a step-leveluses:literal causesstartup_failure.Still true and now measured: the required
.githooks/validate-actions-lock.shchecks membership globally, as its own header says. A bare SHA planted in a keyed workflow whose own section lacks it passes with rc=0 (diff showed the plant applied). This gap is independent of syntax. Whether GitHub kills that exact case at startup is being measured before any shim is built.feat(yaml): KYAML batch 1 + ratchet; withdraw blindness claim (#1124)
feat(yaml): Add KYAML migration script for standards#1024/#1025
feat(yaml): Migrate yaml-comment-proof fixtures to KYAML
docs(yaml): record KYAML scope rulings D280/D307 in §3.4 (#1177)